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Abstract 


The FAA-sponsored Sense and Avoid Workshop for Unmanned Aircraft Systems 
(UAS) defines the concept of sense and avoid for remote pilots as “the capability 
of a UAS to remain well clear from and avoid collisions with other airborne traffic.” 
Hence, a rigorous definition of well clear is fundamental to any separation assurance 
concept for the integration of UAS into civil airspace. This paper presents a family 
of well-clear boundary models based on the TCAS II Resolution Advisory logic. 
Analytical techniques are used to study the properties and relationships satisfied 
by the models. Some of these properties are numerically quantified using statistical 
methods. 



Acronyms 


CAT Collision Avoidance Threshold 

CDF Cumulative Distribution Function 

NAS National Airspace System 

NMAC Near Mid-Air Collision 

RA Resolution Advisory 

SAA Sense and Avoid 

SST Self-Separation Threshold 

SSV Self-Separation Volume 

TCAS Traffic Alerting and Collision Avoidance System 

TCPA Time to Closest Point of Approach 

UAS Unmanned Aircraft Systems 


1 Introduction 

One of the major challenges of integrating Unmanned Aircraft Systems (UAS) into 
the airspace system is the lack of an on-board pilot to comply with the legal re- 
quirement that pilots see and avoid other aircraft in their vicinity. To address this 
challenge, the final report of the FAA-sponsored Sense and Avoid (SAA) Workshop 
for Unmanned Aircraft Systems [2] defines the concept of sense and avoid for remote 
UAS pilots as “the capability of a UAS to remain well clear from and avoid collisions 
with other airborne traffic.” Under this definition, a rigorous definition of well clear 
becomes fundamental to any sense and avoid concept that involves UAS. 

NASA’s Unmanned Aircraft Systems Integration in the National Airspace Sys- 
tem (UAS in the NAS) project aims at conducting research towards the integration 
of civil UAS into non-segregated airspace operations. As part of this project, NASA 
has developed a sense and avoid concept for UAS that extends the concept out- 
lined by the SAA Workshop [1]. The NASA concept includes a volume, namely the 
Self Separation Volume (SSV), located between the Collision Avoidance Threshold 
(CAT), defined by collision avoidance systems, and the Self-Separation Threshold 
(SST), defined by self-separation systems [2], The SSV represents a well-clear bound- 
ary where aircraft inside the SSV are considered to be in well-clear violation. This 
volume is intended to be large enough to avoid safety concerns for controllers and 
see-and-avoid pilots, but small enough to avoid disruptions to traffic flow. A key 
characteristic of NASA’s concept is that the SSV is a conservative extension of the 
CAT defined by the Traffic Alerting and Collision Avoidance System (TCAS). 

TCAS is a family of airborne devices that are designed to reduce the risk of mid- 
air collisions between aircraft equipped with operating transponders [10] . TCAS II, 
the current generation of TCAS devices, is mandated in the US for aircraft with 
greater than 30 seats or a maximum takeoff weight greater than 33,000 pounds. 
Although it is not required, TCAS II is also installed on many turbine-powered 
general aviation aircraft. Version 7.0 is the current operationally-mandated version 
of TCAS II, and Version 7.1 has been standardized [8]. In contrast to TCAS I, the 



first generation of TCAS devices, TCAS II provides resolution advisories (RAs). 
RAs are visual and vocalized alerts that direct pilots to maintain or increase vertical 
separation with intruders that are considered collision threats. TCAS II resolution 
advisories can be corrective or preventive depending on whether the pilot is expected 
to change or maintain the aircraft’s current vertical speed. Corrective RAs are 
particularly disruptive to the air traffic system since they may cause drastic evasive 
maneuvers. For this reason, they are intended as a last resort maneuver when all 
other means of separation have failed. 

The core of the TCAS II RA logic is a test that checks distance and time variables 
for the horizontal and vertical dimensions against a set of pre-defined threshold 
values. To ensure interoperability between NASA’s SAA concept and TCAS, the 
mathematical definition of the volume SSV is based on the TCAS II Resolution 
Advisory Logic [5]. The definition of SSV follows the same logic, but uses different 
thresholds that conservatively extends the collision avoidance threshold provided 
by TCAS. This paper further generalizes the definition of the well-clear violation 
volume presented in [5] and presents a family of mathematical well-clear boundary 
models that are all based on the TCAS II RA logic. Formal and statistical techniques 
are used to study properties of this family of models. 

The formal development presented in this paper is part of the NASA’s Air- 
borne Coordinated Resolution and Detection (ACCoRD) mathematical framework, 
which is electronically available from http://shemesh.larc.nasa.gov/people/ 
cam/ ACCoRD. All theorems in this paper have been formally verified in the Pro- 
totype Verification System (PVS) [7], an automated theorem prover. 


2 Distance and Time Variables 

Distance and time variables are important elements of any separation assurance 
concept. These variables are functions over the aircraft current states which are 
compared against distance and time thresholds. Many conflict detection and res- 
olution systems rely on the time of closest point of approach and the distance at 
that time as their main time and distance variables [4] . This section describes some 
additional distance and time variables that are particularly relevant to the definition 
of a well-clear boundary model. 

This paper assumes that accurate aircraft surveillance information is available 
as horizontal and vertical components in a three-dimensional (3-D) airspace. Let- 
ters in bold- face denote two-dimensional (2-D) vectors. Vector operations such as 
addition, subtraction, scalar multiplication, dot product, i.e., s • v = s x v x + s y v y , 
the square of a vector, i.e., s 2 = s • s, and the norm of a vector, i.e., ||s|| = v/s 2 , 
are defined in a 2-D Euclidean geometry. Furthermore, the expression denotes a 
particular 2-D right-perpendicular vector of v, i.e., v 2 - = ( v y , — v x ), and 0 denotes 
the 2-D vector whose components are 0, i.e., 0 = (0,0). 

The mathematical models presented in this paper consider two aircraft referred 
to as the ownship and the intruder aircraft. For the ownship, the current horizontal 
position and velocity are denoted s D and v Q , respectively. Its altitude and vertical 
speed are denoted s oz and v OZl respectively. Similarly, the horizontal position and 
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velocity of the intruder aircraft are denoted s* and Vj, respectively, and its verti- 
cal altitude and speed are denoted Si Z and v zz , respectively. As it simplifies the 
mathematical development, this paper uses a relative coordinate system where the 
intruder is static at the center of the coordinate system. In this relative system, 
s = s G — Sj and v = v G — Vj represent the horizontal relative position and velocity of 
the aircraft, respectively. Furthermore, s z = s oz — Si z and v z = v oz — V{ z represent 
the vertical relative position and speed of the aircraft, respectively. 

Assuming constant relative horizontal velocity v, the horizontal range between 
the aircraft at any time t is given by 

r(t ) = ||s + tv || = \/s 2 + 2t(s • v) + f 2 v 2 . (1) 


The time of horizontal closest point of approach, denoted f cpa , is the time t that 
satisfies r(t) = 0, i.e., t = — The dot product s • v characterizes whether the 
aircraft are horizontally diverging, i.e., s • v > 0, or horizontally converging, i.e., 
s • v < 0. By convention, f cpa is defined as 0 when v = 0. Hence, f cpa is formally 
defined as 


ic P a(s, v) 


ifv/0, 

V z ' ’ 

0 otherwise. 


(2) 


It is noted that f cpa (s, v) > 0 when the aircraft are horizontally converging, f cpa ( s, v) < 
0 when the aircraft are horizontally diverging, and f cpa (s,v) = 0 when the aircraft 
are neither converging or diverging. The distance at time of closest point of approach 
is defined as 

<ipa(s,v) = r(t cpa (s, v)) = ||s + i cpa (s,v)v||. (3) 


In the vertical dimension, assuming constant relative vertical speed, the relative 
altitude between the aircraft at any time t is given by 


r z {t) = | s z + tv z 


( 4 ) 


The time to co-altitude t coa is the time t that satisfies r z (t) = 0, i.e, t = — 
Similar to the horizontal case, the product s z v z characterizes whether the aircraft 
are vertically diverging, i.e., s z v z > 0, or vertically converging, i.e., s z v z < 0. 
This paper defines time to co-altitude as —1 when the aircraft are not vertically 
converging. Therefore, 


toa (®Z> V z ) — 



if s z v z < 0, 

otherwise. 


( 5 ) 


Formula (5) is well defined since s z v z < 0 implies that v z ^ 0. 


2.1 Horizontal Time Variables 

A (horizontal) time variable is a function that maps a relative horizontal position 
and velocity into a real number. This real number is negative when the aircraft 
are horizontally diverging. When the real number is non-negative, this number 
represents a time that, in a separation assurance logic, is intended to be compared 
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against a time threshold. In this paper, the time threshold is called TTHR. An 
example of a time variable that is used in conflict detection logics is f cpa [4] . 

The time variable used in earlier versions of the TCAS detection logic is called 
tau, denoted r [8]. Tau estimates f cpa , but is less demanding on sensor and surveil- 
lance technology than f cpa . Indeed, r is simply defined as range over closure rate, 
where closure rate is the negative of the range rate, i.e., r = — = —ML = — 

||s|| s ' v 

This paper defines r as — 1 when the aircraft are not horizontally converging. For- 
mally, 


r(s, v) 



if s • v < 0, 
otherwise. 


( 6 ) 


For a limited number of scenarios, the values of r and i cpa coincide. However, in 
most scenarios, the value of r tends toward infinity as the aircraft approach the 
closest point of approach. In general, r is a good approximation of f cpa , but only for 
large values. For that reason, TCAS II uses a modified variant of r called modified 
tau, denoted r mod [8]. Modified tau provides a better estimation of f cpa and has a 
more desirable behavior than r in the proximity of the closest point of approach. 
In [3], modified tau is defined such that r mod = — r ^°^ 0 D ) THR = DTH g. v ~ s ■ Similar to 
t , r mod is defined as -1 when the aircraft are not horizontally converging, i.e., 


T mo d(s, V) 


DTHR 2 -s 2 

s-v 

-1 


if s • v < 0, 
otherwise. 


(7) 


The definition of r mod in Formula (7) depends on DTHR, which is a horizontal distance 
threshold. This threshold is called DMOD in the TCAS II RA logic, and its actual 
value depends on a sensitivity level based on the ownship’s altitude [8]. 

In [6], a time variable called time to entry point, denoted t ep , is proposed. Time 
to entry point is defined as the time to loss of horizontal separation with respect 
to DTHR assuming straight-line aircraft trajectories. Similar to t cpa , t ep decreases 
linearly over time. Time to entry point is formally defined as 

. , f 0(s, v, DTHR, — 1) if s- v < 0 and A(s,v,DTHR) > 0, 

^ep (S) VJ = S (8) 

1 —1 otherwise, 


where 


0(s, v,D,e) 


-s • v + e\J A(s, v, D) 


A(s, v, D) = MV - (s- V) 2 . 


(9) 

( 10 ) 


The function 0 is only defined when v / 0 and A(s, v, D) > 0. In this case, it 
computes the times when the aircraft will lose separation, if e = —1, or regain 
separation, if e = 1, with respect to D. When the aircraft are not horizontally 
converging or A(s,v, D) < 0, time to entry point is defined as -1. Formula (8) is 
well defined since the condition s • v < 0 guarantees that v/0. 
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2.2 Properties of Horizontal Time Variables 

A useful property of a time variable is symmetry. A time variable t var is said to be 
symmetric if and only for all s, v, 

tvar(s, v) = t var (-s,-v). (11) 

Symmetry guarantees that in a pairwise scenario both the ownship and intruder 
aircraft compute the same value for the time variable. Hence, checking a symmetric 
time variable against a given time threshold returns the same Boolean value for both 
aircraft. 

Theorem 1 . The time variables t, t cpa , T mod , and t ep are symmetric. 

It is possible to define time variables that are not symmetric. For instance, 
a time variable that computes the first time when the intruder aircraft enters an 
elliptical area aligned to the ownship trajectory is not symmetric for every scenario. 
However, any time variable can be transformed into a symmetric one by using min 
and max operators. For instance, the time variables min(f var (s, v), t var (— s, — v)) and 
max(£ var (s, v), i var (— s, — v)) are symmetric for any time variable f var . 

Figure 1 shows a graph of r, t ep , r mod , and t cpa versus time for an initial scenario 
where the ownship and intruder aircraft are located at (0 nmi, —3.25 nmi) and 
(—6.25 nmi, 0.25 nmi), respectively, flying at co-altitude. Furthermore, the ownship 
ground speed is 150 kn, heading 53°, and the intruder ground speed is 350 kn, 
heading 90°. 1 In this scenario, the distance threshold DTHR used in the definition of 
r mod and f ep is 1 nmi. This scenario illustrates that while f ep , r mod , and f cpa decrease 
over time, the time variable r decreases up to some point, but then it abruptly 
increases in the vicinity of the closest point of approach. Moreover, when these time 
variables are checked against a time threshold TTHR, represented by the horizontal 
line at 30 seconds, the time variable t ep crosses the time threshold first, followed 
by r mod , then t cpa , and finally r. Interestingly, this ordering property holds for any 
converging scenario and any choice of common threshold values. 

Theorem 2. Let s, v be such that s • v < 0, ||s|| > DTHR. and d cpa { s,v) < DTHR. 
i.e., the aircraft are horizontally converging, are outside the distance threshold DTHR. 
and their distance at time of closest point of approach is less than or equal to DTHR. 
Then the following inequalities hold 

t ep (s, v) < T mod (s, v) < t cpa ( s, v) < r(s, v). (12) 

3 A Family of Well-Clear Boundary Models 

A well-clear boundary specifies the set of aircraft states that are considered to be 
in well-clear violation. Following the TCAS detection logic, the well-clear boundary 
models in this paper are specified by a logical condition that simultaneously checks 

1 Aircraft headings are measured in true north clockwise convention, i.e., 0° points to the north 
and degrees are positive in clockwise direction. 
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Figure 1: Time vs. r, f cpa , r mod , t ep 


horizontal and vertical violations. A horizontal violation occurs if the current range 
is less than a given horizontal distance threshold DTHR. A horizontal violation also 
occurs if distance at time of closest point of approach is less than DTHR and a given 
time variable t var is less than a given time threshold TTHR. In the vertical dimension, 
a similar comparison is made. Vertical well clear is violated if the relative altitude 
is less than a given altitude threshold ZTHR or if the time to co-altitude is less 
than a given vertical time threshold TCOA. The distance and altitude thresholds are 
considered to be positive numbers, i.e. , DTHR > 0 and ZTHR > 0. The time thresholds 
are considered to be non- negative, i.e., TTHR > 0 and TCOA > 0. Formally, this well- 
clear violation condition can be denoted as follows. 

WCVt^{s,Sz^,v z ) = Horizontal_WCV tvar (s, v) and 

Vertical_WCV(s^, v z ), 

where 

Horizontal_WCV( var (s, v) = ||s|| < DTHR or 

(4 pa (s,v) < DTHR and 0 < t var (s,v) < TTHR), 
Vertical_WCV(s~, v z ) = |s 2 | < ZTHR or 0 < t coa (s z ,v z ) < TCOA. 

The logical condition WCVt var . defines a family of well-clear boundary models 
where f var can be instantiated with any time variable, and DTHR, TTHR, ZTHR, and 
TCOA are set to threshold values of interest. The fact that the time thresholds TTHR 
and TCOA can be zero allows for the definition of well-clear boundary models that 
do not depend on time thresholds. For instance, when TTHR = 0 and TCOA = 0, 
WCV tciYA specifies the loss of separation condition for a cylindrical volume of radius 
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DTHR and half-height ZTHR around one of the aircraft. Indeed, in this case, WCVt cpa 
is logically equivalent to the logical condition ||s|| < DTHR and |s z | < ZTHR. 

The TCAS II RA core logic provided in [5] is used by WCV Tmoi , where DTHR, 
TTHR, ZTHR, and TCOA are set to the TCAS II thresholds DMOD, TAU, ZTHR, and 
TAU, respectively. The actual values of these thresholds are given in a table indexed 
by sensitivity levels based on the ownship’s altitude [8]. In the TCAS II RA logic, 
the logical condition d cpa (s,v) < DTHR in the horizontal check is called horizontal 
miss-distance filter and, in that condition, DTHR is set to the miss-horizontal distance 
threshold HMD, which is equal to DMOD. The well-clear boundary model defined 
in [6] is obtained by WCVt ep , where TCOA = TTHR. 

Henceforth, the well-clear models specified by WCV T . WCVt c WCV Tmod , and 
WCV te p will be referred to as WC_TAU, WC_TCPA, WC_TAUMOD, and WC_TEP, 
respectively. The rest of this section studies properties and relations satisfied by 
these models. 

3.1 Symmetry 

A well-clear boundary model specified by WCVt vai , for a given time variable t var , is 
symmetric if and only if 

WCV t ^(s,s z ,v,v z ) = ITCVt var (— s, —s z , —v, —v z ). (14) 

In other words, in a symmetric well-clear boundary model, both the ownship and 
intruder aircraft have the same perception of being well clear or not. 

Theorem 3 (Symmetry). If t var is symmetric, the well-clear boundary model speci- 
fied by WCVt var is symmetric. Hence, by Theorem 1, the well-clear boundary models 
WC-TAU, WC-TCPA, WC-TAUMOD, and WC-TEP are symmetric for any choice 
of threshold values DTHR, TTHR, ZTHR. and TCOA. 

3.2 Inclusion 

Figure 2 illustrates the violation areas for the well-clear boundary models WC_TAU, 
WC_TAUMOD, WC.TCPA, and WC_TEP for the scenario of Figure 1. The thresh- 
old values used in this scenario are DTHR = 1 nmi, TTHR = TCOA = 30 s, and 
ZTHR = 475 ft. The violation areas in these figures are similar to the conflict con- 
tours proposed in [9]. The points in these areas represent future locations of the 
ownship where a well-clear violation will occur assuming that the intruder aircraft 
continues its current trajectory and the ownship either continues its current trajec- 
tory or instantaneously changes its direction but keeps its ground speed. 

Figure 3 overlays the violation areas for the four boundary models. This figure 
illustrates that for a common set of threshold values, the violation area of WC_TAU 
is included in the violation area of WC.TCPA, which is included in the violation area 
of WC-TAUMOD, which is included in the violation area of WC_TEP. Theorem 4 
below states that this inclusion property always holds for any encounter geometry 
and choice of common threshold values. Theorem 4 is a consequence of Theorem 2. 
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Figure 2: Violation areas for scenario of Figure 1 
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Figure 3: Overlay of violation areas for scenario of Figure 1 


Theorem 4 (Inclusion). For all s ,s z ,v,v z and choice of threshold values DTHR. 
TTHR. ZTHR. and TCOA, the following implications hold 

(i) WCV T (s,s z ,\,v z ) = =► WCV tcpa { s,s z ,v,v z ), 

(ii) WCV tcpa (s,s z ,v,v z ) =► WCV Tmod (s,s z ,v,v z ), and 

(Hi) WCV Tmod (s,s z ,v,v z ) =^> WCV tep (s,s z ,v,v z ). 

A key consequence of Theorem 4 is that of the four well-clear boundary models, 
WC TEP provides the most conservative safety margins in terms of having the 
largest violation area and the earliest time whereby a well-clear violation is defined 
to occur. The remaining models can be ordered from most conservative to least 
conservative as WC.TAUMOD, WC_TCPA, and WC_TAU. 

3.3 Local Convexity 

As illustrated by Figure 2, the violation areas are not geometrically convex. How- 
ever, Figures 2(b)-(d) show that from the point of view of the ownship, any ray that 
points towards the violation area has only one intersecting segment. This property 
is referred to as local convexity. It can be verified by inspection of Figure 2(a) that 
this property does not always hold in the case of WC_TAU. A formal definition of 
local convexity follows. 

Definition 1 (Local convexity). A well-clear boundary model specified by WCVt var , 
for a given time variable t var , is locally convex if and only if there are no times 
0 < t\ < t ’2 < ^3 < T such that 

1. the aircraft are not well clear at timet\, i.e., WCVt var (s + tiv, s z + t\v z , v, v z ), 

2 . the aircraft are well clear at time F, i.e., -> WCVt var (s + s z + t- 2 ,v z , v, v z ), 
and 

3. the aircraft not well clear at time 1 3 , i.e., WCVt vaT (s + t$v, s z + t^v z ,\,Vz). 

Thus, a well-clear boundary model is locally convex if for any ownship straight- 
line trajectory there is at most one time interval where the aircraft are not well 
clear. 

Theorem 5. For any choice of threshold values, the well-clear boundary models 
WC-TCPA, WC-TAUMOD, and WC-TEP are locally convex. 

As illustrated by Figure 2(a), the well-clear boundary model WC_TAU is not 
locally convex for all choices of threshold values. In particular, it can be seen in 
Figure 1, assuming straight-line trajectories, that for the same encounter scenario 
the aircraft will have a well-clear violation at 91 s, 7 seconds later they will be 
well clear, and 7 seconds after being well clear, they will have another well-clear 
violation. 

Theorem 6. For some choices of threshold values, the well-clear boundary model 
WC-TAU is not locally convex. 
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Ownship 

(Fix) 


Figure 4: Depiction of a randomly-generated encounter (top view) 


4 Preliminary Statistical Analysis of Well-Clear Bound- 
ary Models 

This section presents a preliminary statistical analysis of the well-clear models de- 
fined in Section 3, with the goal of characterizing the models in terms of relevant 
metrics. In particular, the metrics used for comparison are: (1) the violation areas 
associated with well-clear violations, and (2) the times when a well-clear violation 
first occurs. These metrics serve to validate the inclusion relation given by Theo- 
rem 4. 

4.1 Random Encounter Generation 

The encounter space used in the statistical analysis presented in this section consists 
of a half cylinder of radius, R, and height, h. The top view of this situation is shown 
in Figure 4 for an arbitrary encounter, and the three-dimensional view is shown in 
Figure 5 for a different arbitrary encounter. 

The ownship initial position is chosen to be constant as s Q = (0, — ^ ) and s oz = |. 
The ownship horizontal velocity component v D is randomly chosen from a Burr 
distribution with parameters a = 37.0896, c = 2.6351, A: = 1.00604 and is intended 
to be representative of a fixed-wing UAS, based on the distribution of the velocity 
characteristics of 849 fixed-wing UAS [11]. The ownship vertical velocity component 
v oz is chosen to be zero. The motivation for this particular encounter space is to 
create stress scenarios whereby encounters are biased to result in violations, where 
the violations cover a broad range of encounter geometries. The details of the 
encounter space parameters follow. 
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Figure 5: Depiction of a randomly-generated encounter (3-dimensional view) 


The intruder initial position in the horizontal plane, Sj, is randomly chosen from 
a uniform distribution to be on the left half cylinder circumference as shown in 
Figure 4. The intruder initial position in the vertical plane, s , is chosen from 
a normal distribution having a mean of zero and a standard deviation of ( 2 )(2 99 ) > 

where Si Z is set to be either | or — | if the random variable falls in the upper or 
lower tail of the distribution, respectively. The intruder initial horizontal velocity 
magnitude is chosen from the same distribution as the ownship. Furthermore, the 
intruder’s horizontal velocity vector direction is chosen from a uniform distribution 
to terminate on the small circle shown in Figures 4 and 5. The intruder vertical 
velocity magnitude is randomly chosen from a normal distribution having a mean 
of zero and a standard deviation of ( 2)(2 99 ) > w here Vi z is set to be either Vi z , max or 
—Viz, max if the random variable falls in the upper or lower tail of the distribution, 
respectively. 

4.2 Computation of Violation Area 

Given a set of initial position and velocity states for the ownship and intruder, 
a well-clear violation area is generated by first indexing the ownship trajectory 
through 360 degrees over N steps while holding ||v 0 || and v oz constant, that is, the 
ownship trajectory is swept around a cone of constant height, where each of the 
N trajectories is assumed to remain constant. Next, for each of the N ownship 
trajectories generated, the time interval for any well-clear violation, [f in , f out ], is 
computed for the given trajectory. Then, the associated line segment in three- 
dimensional space is projected onto a two-dimensional plane containing the ownship 
initial position. As discussed in Section 3.3, the WC_TAU model is not locally 
convex. Hence, there may be aircraft states that yield multiple instances of t in and 
t out for a given trajectory. In such cases, each segment is considered separately. The 
resulting geometry for an example encounter are illustrated in Figure 6. 

In the analysis presented in this paper, a violation area associated with a well- 
clear violation is considered to be such a projection into two dimensions. It can be 
verified that for the special case of v oz = 0, the height of the cone collapses to zero, 
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Figure 6: Projection of three-dimensional violation volume into two dimensions 


and the original and projected volumes coincide. 

The area of the two-dimensional violation area is computed as follows, 
consider a differential area in the polar coordinate system given by 


First, 


dA = ^(?’ 2 — r 2 ) d9, 


( 15 ) 


where r corresponds to the distance from the ownship initial position to the position 
at time t [n , r corresponds to the distance from the ownship initial position to the 
position at time i out , and d 0 corresponds to the differential angle between adjacent 
ownship trajectories, that is, 

2vr 
iV' 


d e = 


Thus, the analytical violation area is determined as 


N M 


EEsii-4) 


N— >oo z J ^ ^ N 
k= 1 2=1 


( 16 ) 


where M represents the number of violation regions on the kth trajectory, and if 
a well-clear violation does not occur for the fcth trajectory then r t k and k are 
defined to be zero for that trajectory. 

The algorithm implemented to compute the numerical approximation of the 
violation area is given by 


N * 

fc=l i 



( 17 ) 
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Figure 7: Estimate of probability density function of N for 1000 trials 


where N* denotes a particular choice for N. It can be verified that this estimate 
converges to the actual area as N* approaches infinity. 

The particular choice for N* used for the analysis in the remainder of this paper 
was arrived at through a Monte Carlo experiment which was run until 1000 random 
encounter trajectories resulting in well-clear violations were accumulated. For each 
well-clear violation, N was initialized with N = 2 and the corresponding violation 
area was calculated using Formula (17). The value of N was then incremented by 
one and the violation area recomputed. This process continued until the relative 
difference between the computed area and the previously-computed area was below 
1%. Thus, the value of N for any randomly-generated encounter was chosen as 
the number of partitions that first satisfied the 1% condition. An estimate of the 
distribution of N for the 1000 well-clear violations is shown in Figure 7. This figure 
was used as a basis for choosing N* = 360, which is assumed for the remainder 
of the analysis in this paper. Thus, the differential angle for the velocity sweep is 
necessarily 1°. 


4.3 Analysis 

In the subsequent analysis, the choice is made to present comparisons of WC_TAU, 
WC.TCPA, and WC.TAUMOD relative to WC_TEP. That is, the analysis and 
metrics presented are with respect to WC_TEP. In particular, the two metrics 
used for the following discussion are: (1) the relative difference in violation areas, 
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determined as 


AA(f var ) 

AA(t vax ) 

AA(t vw ) 


A(WCV t J - A(WCV t ) 
A(WCV t J 

A(WCV t J - A(WCV t cpa ) 
A(WCV t J 

AjWCVtJ - A(WCV Tinod ) 
A(WCV t J 


(18) 

(19) 

(20) 


and (2) the difference in time when a well-clear violation will first occur, determined 
as 


A t in (f var ) = U WCVtJ - U WCVrl (21) 

A tin(ivar) = U WCV t J - t in ( WCV tc J , (22) 

Atin(t V ar) = U n (WCV t J - t in ( TEC U Tmod ) . (23) 

The statistical analysis of violation areas is obtained from a Monte Carlo sim- 

ulation with 10,000 well-clear violations (i.e., greater than 10,000 trials). Each 
trial consisted of a random encounter scenario having the geometry discussed in 
Section 4.1. For each trial, if the random encounter resulted in a joint well-clear 
violation for all models, the corresponding areas were computed, followed by the 
relative area differences with respect to WC_TEP. This process was repeated until 
10,000 joint well-clear violations were accumulated, and the cumulative distribution 
function (CDF) for WC_TAUMOD and WC_TCPA with respect to WC_TEP was 
then computed (see Formulas 18-20). Figure 8 shows the results of the Monte Carlo 
experiment, where the threshold values used for the simulation were TTHR = 30 s, 
DTHR = 1 nmi, and ZTHR = 475 ft. The preliminary analysis of the CDFs in Figure 8 
reveal that: (1) the areas for WC_TAUMOD and WC_TEP differ by less than 25% 
in approximately 95% of the well-clear violations, (2) the areas for WC.TCPA and 
WC_TEP differ by as much as 55% in approximately 95% of the well-clear viola- 
tions, and (3) the areas for WC_TAU and WC_TEP differ by as much as 70% in 
95% of the well-clear violations. The Monte-Carlo results provide an experimental 
validation of the inclusion property discussed in Section 3.2. 

The second metric used to analyze the well-clear models is f in , the time when a 
well-clear violation first occurs (see Formulas 21-23). During the same Monte Carlo 
experiment previously discussed, if a joint well-clear violation for an initial set of 
randomly-generated ownship and intruder positions and velocities occurs, then the 
time when the well-clear violation occurs for each model is computed using only 
the initial positions and velocities. For each encounter resulting in a well-clear 
violation, the time difference with respect to WC_TEP is computed for WC_TAU, 
WC_TCPA, and WC_TAUMOD. Upon accumulation of 10,000 well-clear violations, 
the CDFs of the time difference in time were generated. The results of the Monte 
Carlo experiment are shown in Figure 9. 

The CDFs in Figure 9 show that: (1) the difference between t in for WC_TAUMOD 
and WC_TEP is limited to approximately 15 s, (2) the difference between t in for 
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Figure 8: CDF of relative difference in area with respect to WC_TEP 



Figure 9: CFD of absolute difference first time to violation with respect to WC_TEP 
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Figure 10: Encounter geometry of interest: large difference in t in 


WCLTCPA and WC_TEP is limited to exactly 30 s, which is TTHR for the experi- 
ment, and (3) the difference between t in for WC_TAU and WC_TEP may slightly 
exceed the 30-second TTHR. 

While Figures 8 and 9 provide a visual validation of the inclusion property, 
additional insight can be gained by considering some examples designed to illustrate 
the implications of each particular well-clear model. Figures 10 and 11 show two 
such examples. 

Figure 10 shows an encounter geometry designed to illustrate a case when all of 
the well-clear models indicate a well-clear violation will occur at some time in the 
future given the initial ownship and intruder trajectories, yet a significant difference 
in t in exists for each approach. In particular, the value for t in for each model is: 

1. WC_TAU 42 s, 

2. WC_TCPA 41.7 s, 

3. WCLTAUMOD 23.9 s, 

4. WC_TEP 11.7 s. 

Thus, the maximum At in is WCLTEP — WCLTAU = 30.3 s. This scenario depicts a 
situation where every model will eventually determine a well-clear violation exists 
for the current, const ant- velocity trajectory, however there is a wide range in t in , 
the time when such a violation first occurs. The figure also demonstrates another 
case of violation of the local convexity property for the WC_TAU model. 
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Figure 11: Encounter geometry of interest: non-agreement over WCVt var 

Figure 11 shows a case when all but one well-clear model results in a well-clear 
violation for the initial trajectory. In particular, WC_TCPA, WC_TAUMOD, and 
WC_TEP produce well-clear boundaries in any horizontal direction the ownship may 
travel, however, the WC_TAU model produces a region on the ownship’s current 
trajectory in which the ownship may pass without incurring a well-clear violation. 
This example was selected to illustrate that there are other important, characterizing 
properties of the models appropriate for investigation beyond area and t in . This 
paper does not present an extensive analysis of such considerations. 

5 Conclusion 

A family of well-clear boundary models is presented. This family generalizes the 
TCAS II Resolution Logic with different possible definitions of horizontal time vari- 
ables including tau, time to closest point of approach, modified tau, and time to 
entry point. Analytical techniques are used to study the properties of this model. 
For instance, it has been formally proved that the well-clear model based on time 
to entry point is more conservative than tau, time to closest point of approach, and 
modified tau for any scenario and any common choice of threshold values. Further- 
more, it is shown that all the models in this family are symmetric, i.e. , the ownship 
and intruder aircraft have the same perception of being well-clear or not at any 
moment in time. Except for the model based on tau, all the models are locally 
convex meaning that there is at most one interval of time when the aircraft are not 
well-clear, assuming straight-line trajectories. 


17 


Some of these properties are validated through numerical quantification using 
statistical methods. In particular, random encounters are generated in Monte Carlo 
fashion, and distributions for area and t in are determined for 10,000 data points. 
This analysis represents a preliminary look at some characterizing properties of the 
family of well-clear boundary models. 

The mathematical development presented in this paper has been mechanically 
verified in the Prototype Verification System (PVS) [7]. This level of rigor is justified 
by the safety-critical nature of the well-clear concept to the integration of Unmanned 
Aircraft Systems in the the National Aerospace System. 
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